peach-browser / 2945bb7a571a

fix: bind Firefox passkey completion to the pending ceremony (v4.8.3) Codex Security 2026-08-04 MEDIUM (broken-access-control.passkey-ceremony-approval): COMPLETE_FIREFOX_PASSKEY_CREATE stored a passkey for any caller-chosen rpId without binding to the pending ceremony, so any page could overwrite a stored passkey via the relay (findAttachTarget/updateEntry). Fix: - completeFirefoxPasskeyCreate now requires an exact match against the background-minted pending ceremony (requestId + rpId + userHandle; the userHandle is 32 random bytes that never leave extension context). - INITIATE_FIREFOX_PASSKEY_CREATE validates the rpId against the browser-attested sender origin (isValidRpId), closing the sibling rpId-spoofing gap in the approval popup. - COMPLETE_FIREFOX_PASSKEY_CREATE removed from the page-relay allowlist; the legitimate sender is only the approval popup (already sender-gated to extension origins in v4.8.2). Tests: pending-binding reject/accept, INITIATE origin mismatch, relay block.

dev · 3 weeks ago · 2026-08-04 · 5.8 MB

parent: c3c0d13e0280